Auth via BOT_INGEST_SECRET bearer header (src/lib/bot-auth.ts), not Auth.js session -- caller is the inventory-capture Telegram bot service, not a browser. Co-Authored-By: Claude Sonnet 5 <[email protected]>